DeepSeek Elastic Compute (DSec)
Large-scale agentic training and evaluation with large language models (LLMs) rely on isolated, stateful execution environments in which models inspect repositories, invoke tools, execute commands, and interact with task-specific services. These workloads create sandboxes in large bursts, span heterogeneous functionality and isolation requirements, retain state across long interactions, and draw from large image corpora with limited reuse.
This report presents DeepSeek Elastic Compute (DSec), a production sandbox platform that exposes FnCall, container, microVM, and full-VM sandbox backends through a unified SDK. DSec coordinates placement and lifecycle management across the cluster, composes environments from independently versioned layers, combines memory sharing, reclamation, and CPU scheduling for high-density execution, and loads image data on demand from Fire-Flyer File System (3FS), a cluster-wide distributed filesystem.
DSec is co-designed with the reinforcement learning (RL) framework, decouples stateful rollout execution from preemptible GPU training, coordinates sandbox lifecycle with training to preserve rollout state while reclaiming idle resources, and mitigates agent misbehavior such as reward hacking.
Scale
A single production-scale unit of DSec spans around 160 nodes, serving about 3 million sandboxes per day. In production, it supports over 380,000 concurrent sandboxes and sustains over 5,000 sandbox creations per second.
Key design properties
Agentic sandbox workloads addressed by DSec include:
- Bursty creation — A single job may request up to 32K sandbox instances concurrently.
- High density — A single node can host up to 800 microVMs or 3,200 containers under overcommit.
- Stateful, long-lived sessions — Agents modify files, install dependencies, and start services across many LLM turns.
- Heterogeneous workloads — OJ-like script execution, software-engineering repos, security tasks, computer-use, Android VMs, and full-system environments.
- High environment diversity — Many distinct images with limited reuse; on-demand loading reduces cumulative disk writes by 57% vs eager pulling.
- Untrustworthy agent execution — Requires fine-grained access control and misbehavior analysis.
- Interruptible execution — GPU training preemption requires state preservation and recovery.
Sandbox backends
| Backend | Typical use |
|---|---|
| FnCall | Short stateless tasks, OJ workloads, GPU kernels |
| Container | Software-engineering and tool-use workloads |
| MicroVM (Firecracker) | Security-sensitive tasks, stronger isolation |
| Full VM (QEMU) | Android, GUI, COTS OS environments |
Users access DSec through libdsec, a Python client library providing unified sandbox creation and operation while requiring callers to select the appropriate backend for each task.